Obligations Are Business Rules

One of the Sidebars¹ to the Business Agility Manifesto² unabashedly indicts the software industry for its long-standing failure to provide direct support for obligations, an obvious and fundamental aspect of real-life business activity.

8. The software industry has failed to appreciate something fundamental about business activity. Business is grounded in obligations, which can be violated. Such business rules require selective reaction to violations (for example alerts or corrective measures) and graded levels of enforcement (all the way from strictly enforced to simply guideline).

Where can you find obligations in business? Virtually everywhere you look: acts, laws, statutes, regulations, contracts, MOUs, agreements, terms & conditions, deals, bids, deeds of sale, warranties, guarantees, prospectuses, licenses, citations, certifications, notices – and of course, business policies.

Direct support for obligations is a fundamental capability your organization needs in the Knowledge Age. What’s it about?

Behavioral Rules vs. Decision Rules

In the relevant business rule standard, obligations are behavior rules³, one of two major varieties of rule. Behavior rules govern the conduct of on-going business activity by ‘watching’ for violations. Here is an example of a behavioral rule.

A student with a failing grade must not be an active member of a sports team.

This business rule is not about selecting the most appropriate sports team for a student, nor does it apply only at a single point of determination (e.g., when a case of a student wanting to join a team comes up). Instead, the business rule is meant to be enforced continuously – for example, if a student who is already active on some sports team should let his or her grades fall. In other words, the business rule is about shaping (governing) the conduct of on-going business activity; that is, ensuring its integrity.

In general, every behavioral rule produces two or more kinds of operational business events where it could potentially be violated or needs to be evaluated. (I mean produces here in the sense of can be analyzed to discover.) Unless you start your analysis from the rule, however – and not some process or use case – you’ll never achieve consistent enforcement of the rule.⁴

Behavioral rules need to be clearly distinguished from definitional rules or decision rules, the other variety of rule.⁵ Table 1 identifies the fundamental differences between behavioral rules and decision rules.⁶

Table 1. Behavioral Rules vs. Decision Rules

Violations and Enforcement

Fundamental to behavioral rules is the assumption that violations can be detected so the rules can be enforced – hopefully in real time – and so the business capability can react promptly and selectively to them. If you can’t detect violations, how can you run the business?!⁸

There are three fundamental business questions regarding appropriate enforcement of each behavioral rule, as follows. None of these questions, by the way, apply to definitional or decision rules.

1. How strictly should the behavioral rule be enforced?
2. What message is appropriate when a violation occurs?
3. What business response is needed?

Addressing these enforcement questions intelligently is key to creating highly-agile business capabilities, ones that can evolve rapidly in day-to-day operation. The remainder of this discussion examines each of these questions in turn.

1. Enforcement Level

How strictly should the behavioral rule be enforced?

Example

Business Rule: A service representative must not be assigned to good customers in more than 3 states or provinces.

Ask: How strictly should this business rule be enforced?

Enforcement Level: Override by pre-authorized actor

The most obvious enforcement levels for behavioral rules are listed in Table 2.⁹ Don’t overlook the last one in the table. A behavioral rule that is actively evaluated, but not enforced, is (literally) a guideline. Guidelines are business rules too!

Table 2. Common Enforcement Levels for Behavioral Rules

2. Guidance Message

What message should be returned when a violation of the behavioral rule occurs?

When a behavioral rule is violated, somebody, often a business actor directly engaged in a business process, usually needs to know about it. The violation means the work being conducted has strayed outside the boundaries of what the business deems acceptable or desirable. From the business perspective some error has been made, so some error message should go to someone. What should that error message say?

As a default, I like to say that the business rule statement is the error message. From a business point of view, that equivalence must always be true – what else are behavioral rules about?! For the service-representative business rule earlier, the appropriate message might therefore simply be “A service representative must not be assigned to good customers in more than 3 states or provinces.”

Every guidance message¹¹ should be as friendly and as helpful as possible. More explanation or suggestions can be appended or substituted as desired. Perhaps a link to other media (e.g., a how-to video) can be provided. Sometimes the best guidance message takes the form of some icon or signal (e.g., a warning light turning to yellow or red). In all cases, guidance messages should be made available only to people who are qualified and capable.

3. Violation Response

Does the appropriate violation response for the behavioral rule need to be more selective, rigorous, or comprehensive than simply a message?

Example

Business Rule: A cursory review of a received engineering design must be conducted within 5 business days from the date received.

Ask: What violation response is appropriate for this rule?

Violation Response: The received engineering design must be brought to the attention of the manager of the department by the morning of the next business day.

In general, a violation response can be one or more of some business processes, sanctions, operational business decisions, special notifications, etc. Real-time violation responses are critical in cases of potential fraud or malicious business behavior.

Ron Ross, Principal and Co-Founder of Business Rules Solutions, LLC, is internationally acknowledged as the “father of business rules.” Recognizing early on the importance of independently managed business rules for business operations and architecture, he has pioneered innovative techniques and standards since the mid-1980s. He wrote the industry’s first book on business rules in 1994. With BRS’s client roster of Fortune 500 companies and governments, Ron consults, speaks and teaches worldwide. He has served as the chair of the International Business Rules & Decisions Forum conference since 1997, now part of the Building Business Capability (BBC) conference.

Ron is also the author of 10 professional books, as well as the executive editor of the Business Rules Journal. Through these publications, as well as on the online forum BRCommunity and his blog, Ron enjoys sharing his knowledge and experience in consulting and business rules.

Outside of work, Ron enjoys walking his dogs, travelling with his three children, and tweeting. For fresh nuggets of information, follow him @Ronald_G_Ross!

---

References/footnotes:

1. Sidebar for the Software Industry: Reconfiguration Agility https://busagilitymanifesto.org/accompaniments/supplements/sidebar-for-the-software-industry
2. The Business Agility Manifesto: Building for Change, by Roger T. Burlton, Ronald G. Ross and John A. Zachman, 2017 https://busagilitymanifesto.org/
3. Behavioral business rules are a central notion of the OMG standard Semantics of Business Vocabulary and Business Rules (SBVR). For more information on SBVR, see SBVR Insider on BRCommunity.com, http://www.brcommunity.com/standards.php?id=620.
4. An example is worked through on pp 170-174 of Building Business Solutions: Business Analysis with Business Rules (2^nd ed), by Ronald G. Ross with Gladys S.W. Lam, 2015, 308 pp.
5. The material that follows is extracted from pp. 170-189 of Building Business Solutions: Business Analysis with Business Rules (2^nd ed).
6. Behavioral rules also have nothing in common with inference rules, the central feature of most rule engines and decision management systems (not all) currently on the market.
7. free on www.RuleSpeak.com
8. To say it differently, if you can’t detect violations, but you can still run the business, perhaps you don’t need the business rule at all(!).
9. from Business Rule Concepts: Getting to the Point of Knowledge (4th ed), by Ronald G. Ross 2013, 162pp. Table 12-1 discusses additional enforcement levels. It also provides tips for designing procedures where behavioral rules are involved (which is just about all of them!).
10. Strictly enforced is assumed as the default enforcement level.
11. Rather than ‘error message’ (which sounds technical) or ‘violation message’ (which sounds harsh, especially for guidelines), I prefer guidance message.